Hostname routing GA + public IP range for initial resolved IPs - #32544
Open
nikitacano wants to merge 4 commits into
Open
Hostname routing GA + public IP range for initial resolved IPs#32544nikitacano wants to merge 4 commits into
nikitacano wants to merge 4 commits into
Conversation
nikitacano
requested review from
a team,
alpdot,
asamborski,
elithrar,
fabienne-cf,
gofish,
hoan-pom,
jeffh-cloudflare,
kennyj42,
ncrouch-cflare and
steve-cloudflare
as code owners
August 5, 2026 10:55
Contributor
Review
👉 Fix in your agent 👈Fix the following review findings in PR #32544 (https://github.com/cloudflare/cloudflare-docs/pull/32544).
Before making changes, review each finding and present a brief summary table:
- For each finding, state whether you agree, disagree, or need clarification
- If you disagree (e.g. the fix requires disproportionate effort for minimal benefit,
or the finding is factually incorrect), explain why
- If you need clarification before deciding, ask those questions
- Then share your plan for which issues to tackle and in what order
After triaging, follow this order:
1. Post a comment on this PR for any findings you are skipping, with the finding ID and your reasoning.
2. Then commit the fixes for the legitimate findings.
The comment must come before the commit — the bot reads PR comments when a new
push triggers a review, so skip comments posted after the push will be missed.
---
## Code Review
### Warnings (4)
#### CR-31b2f54efa67 · Glossary definition is stale
- **File:** `src/content/docs/cloudflare-one/networks/routes/configure-initial-resolved-ips.mdx` line 13
- **Issue:** The page uses <GlossaryTooltip term="initial resolved IP">, but the glossary entry for "initial resolved IP" still describes the IPv4 range as `100.80.0.0/16` (CGNAT). This contradicts the page and the rendered partial, which state the new default is `172.64.128.0/20`.
- **Fix:** Update the "initial resolved IP" glossary definition in src/content/glossary/cloudflare-one.yaml to reflect the new default `172.64.128.0/20` range and the configurable IPv4 range.
#### CR-b4a8f09e8641 · Factual inconsistency with glossary definition
- **File:** `src/content/partials/cloudflare-one/gateway/egress-selector-chrome-issue.mdx` line 7
- **Issue:** The partial states the new current default initial resolved IP range is `172.64.128.0/20` and earlier calls `100.80.0.0/16` a legacy default, but the glossary entry for `initial resolved IP` currently defines it as IPs randomly selected from `100.80.0.0/16` with no mention of the new default.
- **Fix:** Update the glossary entry for `initial resolved IP` (in `src/content/glossary/cloudflare-one.yaml`) to describe the new `172.64.128.0/20` default and mark `100.80.0.0/16` as legacy, or add both ranges with context about when each applies.
#### CR-1bd2c1f1b2f2 · Filename/content mismatch on IP type
- **File:** `src/content/partials/cloudflare-one/gateway/egress-selector-cgnat-ips.mdx` line 6
- **Issue:** The partial file is named egress-selector-cgnat-ips, but the added IP ranges are 172.64.128.0/20 and 2606:4700:0cf1:4000::/64, which are public Cloudflare ranges rather than CGNAT (100.64.0.0/10). Existing callers still describe the partial as the 'CGNAT space'.
- **Fix:** Rename the partial to reflect that it now contains initial resolved public IP ranges (e.g., egress-selector-initial-resolved-ips) and update the three callers that still refer to these as CGNAT addresses.
#### CR-f633a07326f9 · Inconsistent documented IP range across docs
- **File:** `src/content/docs/cloudflare-one/networks/connectors/cloudflare-mesh/routes.mdx` line 236
- **Issue:** This change introduces `172.64.128.0/20` as the IPv4 range for hostname routing / Gateway initial resolved IPs. Other published docs still list the IPv4 initial resolved IP range as `100.80.0.0/16`: `src/content/docs/cloudflare-one/networks/routes/reserved-ips.mdx`, `src/content/docs/cloudflare-one/networks/connectors/cloudflare-mesh/client-devices.mdx`, and `src/content/glossary/cloudflare-one.yaml`. The IPv6 range is consistent (`2606:4700:0cf1:4000::/64`), but the IPv4 mismatch is confusing.
- **Fix:** Confirm whether `172.64.128.0/20` replaces `100.80.0.0/16` for all initial resolved IP use cases; if so, update the related pages and glossary to match. If Mesh hostname routing uses a distinct public range, clarify that distinction in the text.
### Suggestions (1)
#### CR-c706a0e901cd · Missing IPv6 range in return-route note
- **File:** `src/content/docs/cloudflare-one/networks/connectors/cloudflare-mesh/routes.mdx` line 298
- **Issue:** The return-route note lists `172.64.128.0/20` for the initial resolved IP range but omits the IPv6 range `2606:4700:0cf1:4000::/64`, even though the prerequisites table and DNS filtering section consistently include both IPv4 and IPv6.
- **Fix:** Add the IPv6 initial resolved IP range to the return-route note, e.g. `2606:4700:0cf1:4000::/64` -> next hop is the Mesh node's local IP.
---
## Style Guide Review
### Warnings (1)
#### SG-77bff0568505 · Avoid directional words
- **File:** `src/content/partials/cloudflare-one/gateway/egress-selector-chrome-issue.mdx` line 9
- **Issue:** Line 9 uses 'below' in 'The workarounds below use Google Chrome Enterprise policies.'
- **Fix:** Replace the directional word with a direct reference, e.g., 'The workarounds under [Workarounds](#workarounds) use...' or rephrase without 'below.'
### Suggestions (5)
#### SG-d28019e6e7a7 · Use APIRequest for Cloudflare API endpoints
- **File:** `src/content/docs/cloudflare-one/networks/routes/configure-initial-resolved-ips.mdx` line 44
- **Issue:** Line adds `<CURL>` documenting the Cloudflare API GET endpoint `/zerotrust/subnets/initial_resolved_ip/$ADDRESS_FAMILY`.
- **Fix:** Use `<APIRequest>` instead of `<CURL>` when documenting Cloudflare API endpoints.
#### SG-7742e5c1dd02 · Use APIRequest for Cloudflare API endpoints
- **File:** `src/content/docs/cloudflare-one/networks/routes/configure-initial-resolved-ips.mdx` line 69
- **Issue:** Line adds `<CURL>` documenting the Cloudflare API PUT endpoint `/zerotrust/subnets/initial_resolved_ip/$ADDRESS_FAMILY`.
- **Fix:** Use `<APIRequest>` instead of `<CURL>` when documenting Cloudflare API endpoints.
#### SG-b6fca2688a3a · Lists with fewer than three items
- **File:** `src/content/changelog/tunnel/2026-08-12-hostname-routing-ga-public-initial-resolved-ips.mdx` line 17
- **Issue:** The added bullet list contains only two items (`Cloudflare Tunnel` and `Cloudflare Mesh`).
- **Fix:** Consider writing the two items as prose or adding a third item so the list has at least three entries.
#### SG-19d6464a6cb4 · Bullet list with fewer than three items should be prose
- **File:** `src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-device-client.mdx` line 154
- **Issue:** Line 154 begins a bulleted list with only two items (`Initial resolved IPs:` and `DNS queries for your private hostname`).
- **Fix:** Combine the two items into prose, for example: 'Cloudflare One Clients must forward initial resolved IPs and DNS queries for your private hostname to Cloudflare.'
#### SG-5f621e5f6c28 · Lists with fewer than three items
- **File:** `src/content/partials/cloudflare-one/gateway/egress-selector-cgnat-ips.mdx` line 6
- **Issue:** Added lines contain a two-item bulleted list (`IPv4` and `IPv6` ranges).
- **Fix:** Consider rewriting the two IP ranges as prose instead of a bullet list.
Code ReviewThis code review is in beta and may not always be helpful — use your judgment. Warnings (4)
Suggestions (1)
ConventionsNo convention issues found. Style Guide ReviewWarnings (1)
Suggestions (5)
CommandsOnly codeowners can run commands. Post a comment with the command to trigger it.
|
github-actions
Bot
added
product:cloudflare-one
product:load-balancing
github-actions
Bot
assigned
hoan-pom,
asamborski,
elithrar,
kennyj42,
fabienne-cf,
gofish,
ncrouch-cflare,
alpdot,
jeffh-cloudflare and
steve-cloudflare
Contributor
|
This pull request requires reviews from CODEOWNERS as it changes files that match the following patterns:
|
nikitacano
force-pushed
the
ncano/hostname-routing-public-ip-ga
branch
from
August 5, 2026 10:57
8e44cc2 to
67b83bc
Compare
Contributor
Contributor
Author
|
Triaged the review findings — fixing all of them except one: SG-6f7fe6807916 (skipping): The 2-item `IPv4:` / `IPv6:` bullet list in `egress-selector-cgnat-ips.mdx` is a pre-existing convention used identically across a dozen+ other files in this repo (WARP CGNAT ranges, device IP ranges, etc.), none of which are flagged for the same rule. This PR only changed the CIDR values on those lines, not the list structure itself. Converting just this one instance to prose would reduce scannability for a quick-reference technical pair and would create inconsistency with the surrounding docs ecosystem rather than resolve one. I'd rather see this addressed as a deliberate, repo-wide style pass than a one-off here. CR-0248079a6e48: 4 of the 5 files cited were already fixed by an earlier push ( All other findings (contraction, root-relative link, directional words, passive voice, semicolon splits) are legitimate and being fixed in the next commit. |
nikitacano
added a commit
that referenced
this pull request
Aug 5, 2026
…agram Review findings: - Fix remaining hardcoded 100.80.0.0/16 in MeshHostnameRoutingDiagram.astro (CR-0248079a6e48) - Remove contraction, use root-relative internal link, remove directional words (above/below), split semicolon-joined clauses into separate sentences, and rewrite passive voice as active voice in reserved-ips.mdx and the changelog entry (SG-3dfd068375a0, SG-e45dffc72174, SG-344e30d2eb64, SG-5c7af6376962, SG-5b986e4edf2f, SG-983f7d771c3b, SG-29585027da84, SG-e7bfde642a70, SG-486f00ad5738, SG-261ff277316f, SG-01bc9aa619e4) - Skipping SG-6f7fe6807916 (2-item bullet list to prose) per PR comment New diagram: - Add TunnelHostnameRoutingDiagram.astro, modeled on the existing MeshHostnameRoutingDiagram.astro, showing the same generic flow (client -> Gateway -> connector -> destination) adapted for Cloudflare Tunnel and its dual private/public hostname destinations - Place it on connect-private-hostname.mdx (previously had no diagram). Not added to egress-cloudflared.mdx, which already has its own scenario-specific mermaid diagram for the AWS/egress example
nikitacano
added a commit
that referenced
this pull request
Aug 6, 2026
…agram Review findings: - Fix remaining hardcoded 100.80.0.0/16 in MeshHostnameRoutingDiagram.astro (CR-0248079a6e48) - Remove contraction, use root-relative internal link, remove directional words (above/below), split semicolon-joined clauses into separate sentences, and rewrite passive voice as active voice in reserved-ips.mdx and the changelog entry (SG-3dfd068375a0, SG-e45dffc72174, SG-344e30d2eb64, SG-5c7af6376962, SG-5b986e4edf2f, SG-983f7d771c3b, SG-29585027da84, SG-e7bfde642a70, SG-486f00ad5738, SG-261ff277316f, SG-01bc9aa619e4) - Skipping SG-6f7fe6807916 (2-item bullet list to prose) per PR comment New diagram: - Add TunnelHostnameRoutingDiagram.astro, modeled on the existing MeshHostnameRoutingDiagram.astro, showing the same generic flow (client -> Gateway -> connector -> destination) adapted for Cloudflare Tunnel and its dual private/public hostname destinations - Place it on connect-private-hostname.mdx (previously had no diagram). Not added to egress-cloudflared.mdx, which already has its own scenario-specific mermaid diagram for the AWS/egress example
nikitacano
force-pushed
the
ncano/hostname-routing-public-ip-ga
branch
from
August 6, 2026 11:17
b74b02f to
f683f97
Compare
nikitacano
added a commit
that referenced
this pull request
Aug 6, 2026
…agram Review findings: - Fix remaining hardcoded 100.80.0.0/16 in MeshHostnameRoutingDiagram.astro (CR-0248079a6e48) - Remove contraction, use root-relative internal link, remove directional words (above/below), split semicolon-joined clauses into separate sentences, and rewrite passive voice as active voice in reserved-ips.mdx and the changelog entry (SG-3dfd068375a0, SG-e45dffc72174, SG-344e30d2eb64, SG-5c7af6376962, SG-5b986e4edf2f, SG-983f7d771c3b, SG-29585027da84, SG-e7bfde642a70, SG-486f00ad5738, SG-261ff277316f, SG-01bc9aa619e4) - Skipping SG-6f7fe6807916 (2-item bullet list to prose) per PR comment New diagram: - Add TunnelHostnameRoutingDiagram.astro, modeled on the existing MeshHostnameRoutingDiagram.astro, showing the same generic flow (client -> Gateway -> connector -> destination) adapted for Cloudflare Tunnel and its dual private/public hostname destinations - Place it on connect-private-hostname.mdx (previously had no diagram). Not added to egress-cloudflared.mdx, which already has its own scenario-specific mermaid diagram for the AWS/egress example
nikitacano
force-pushed
the
ncano/hostname-routing-public-ip-ga
branch
from
August 6, 2026 11:30
f683f97 to
dbd0aeb
Compare
Contributor
Author
|
Triaged this review round — fixing 7 of 10, skipping 3: CR-75191d26a991 & CR-2e38a631e947 (skipping — factually incorrect): Both claim the SG-1d1e92a91815 (skipping): Same reasoning as the earlier skipped finding on this PR (SG-6f7fe6807916) — the "Non-HTTPS applications" bullet in Also fixing CR-5357f89feae6, CR-16b1138e86f9, CR-92354eddb752, CV-438909ac299b, SG-f9a01b8c897a, and SG-30ddbd747707 in the next push. One note on CR-5357f89feae6: |
kennyj42
reviewed
Aug 6, 2026
| @@ -0,0 +1,39 @@ | |||
| --- | |||
| title: Hostname routing is now generally available, with a new public IP range for initial resolved IPs | |||
Collaborator
There was a problem hiding this comment.
Do you want it to be Tunnel Hostname? or something that calls out what kind of routing it is.
Just thinking about when your changelog gets posted on twitter and stuff like that, might need one extra identifier.
Contributor
Author
There was a problem hiding this comment.
It works for both Tunnel and Mesh, so trying to go generic here :)
kennyj42
reviewed
Aug 6, 2026
|
|
||
| import { DashButton, Render, GlossaryTooltip } from "~/components"; | ||
|
|
||
| [Hostname routing](https://blog.cloudflare.com/tunnel-hostname-routing/) is now generally available. Instead of managing static IP lists and routes, you can route traffic by hostname across multiple Cloudflare One connectors: |
Collaborator
There was a problem hiding this comment.
I'm not clear what "route traffic by hostname across multiple connectors means"
I would be more explicit here maybe. like:
Tunnel hostname routing now supports routing traffic across multiple Cloudflare One Connectors with a dynamic set of IPs (? or something). Previously, you had to manage static IP address lists.
kennyj42
reviewed
Aug 6, 2026
|
|
||
| <Render file="gateway/egress-selector-cgnat-ips" product="cloudflare-one" /> | ||
|
|
||
| **Why this is changing:** Starting with [Chrome 142](https://developer.chrome.com/release-notes/142), Google Chrome's Local Network Access restrictions block background requests to CGNAT addresses (`100.64.0.0/10`), which included the previous initial resolved IP default (`100.80.0.0/16`). This could silently break hostname-based Gateway features for Chrome users, and required Chrome Enterprise policy workarounds. The new default range is public Cloudflare address space, so it is not affected by this restriction. |
Collaborator
There was a problem hiding this comment.
is this all Chromium browsers or just chrome?
Contributor
Author
There was a problem hiding this comment.
It will affect all Chromium browsers: https://chromium.googlesource.com/chromium/src/+/refs/heads/main/components/policy/resources/templates/policy_definitions/LocalNetworkAccessSettings/LocalNetworkAccessRestrictionsTemporaryOptOut.yaml. Will make it clear.
kennyj42
approved these changes
Aug 6, 2026
nikitacano
added a commit
that referenced
this pull request
Aug 6, 2026
…agram Review findings: - Fix remaining hardcoded 100.80.0.0/16 in MeshHostnameRoutingDiagram.astro (CR-0248079a6e48) - Remove contraction, use root-relative internal link, remove directional words (above/below), split semicolon-joined clauses into separate sentences, and rewrite passive voice as active voice in reserved-ips.mdx and the changelog entry (SG-3dfd068375a0, SG-e45dffc72174, SG-344e30d2eb64, SG-5c7af6376962, SG-5b986e4edf2f, SG-983f7d771c3b, SG-29585027da84, SG-e7bfde642a70, SG-486f00ad5738, SG-261ff277316f, SG-01bc9aa619e4) - Skipping SG-6f7fe6807916 (2-item bullet list to prose) per PR comment New diagram: - Add TunnelHostnameRoutingDiagram.astro, modeled on the existing MeshHostnameRoutingDiagram.astro, showing the same generic flow (client -> Gateway -> connector -> destination) adapted for Cloudflare Tunnel and its dual private/public hostname destinations - Place it on connect-private-hostname.mdx (previously had no diagram). Not added to egress-cloudflared.mdx, which already has its own scenario-specific mermaid diagram for the AWS/egress example
nikitacano
force-pushed
the
ncano/hostname-routing-public-ip-ga
branch
from
August 6, 2026 15:14
dbd0aeb to
0f69bce
Compare
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| class="tunnel-hostname-diagram not-content" | ||
| aria-label="How hostname routing works with Cloudflare Tunnel: a client requests a hostname, Cloudflare Gateway assigns a token IP and rewrites the destination, and the tunnel delivers the traffic to a private host on your network or egresses it to the public Internet" | ||
| > | ||
| <ol class="flow" role="list"> |
Contributor
There was a problem hiding this comment.
🚫 [eslint] <eslint.rules.astro/jsx-a11y/no-redundant-roles> reported by reviewdog 🐶
The element ol has an implicit role of list. Defining this explicitly is redundant and should be avoided. (astro/jsx-a11y/no-redundant-roles)
nikitacano
added a commit
that referenced
this pull request
Aug 6, 2026
…agram Review findings: - Fix remaining hardcoded 100.80.0.0/16 in MeshHostnameRoutingDiagram.astro (CR-0248079a6e48) - Remove contraction, use root-relative internal link, remove directional words (above/below), split semicolon-joined clauses into separate sentences, and rewrite passive voice as active voice in reserved-ips.mdx and the changelog entry (SG-3dfd068375a0, SG-e45dffc72174, SG-344e30d2eb64, SG-5c7af6376962, SG-5b986e4edf2f, SG-983f7d771c3b, SG-29585027da84, SG-e7bfde642a70, SG-486f00ad5738, SG-261ff277316f, SG-01bc9aa619e4) - Skipping SG-6f7fe6807916 (2-item bullet list to prose) per PR comment New diagram: - Add TunnelHostnameRoutingDiagram.astro, modeled on the existing MeshHostnameRoutingDiagram.astro, showing the same generic flow (client -> Gateway -> connector -> destination) adapted for Cloudflare Tunnel and its dual private/public hostname destinations - Place it on connect-private-hostname.mdx (previously had no diagram). Not added to egress-cloudflared.mdx, which already has its own scenario-specific mermaid diagram for the AWS/egress example
nikitacano
force-pushed
the
ncano/hostname-routing-public-ip-ga
branch
from
August 6, 2026 15:49
0f69bce to
414c96d
Compare
Hostname routing (Cloudflare Tunnel and Cloudflare Mesh) is now generally available. Alongside GA, the default IPv4 range used for Gateway initial resolved IPs (token IPs) is changing from a CGNAT range (100.80.0.0/16) to a public Cloudflare-owned range (172.64.128.0/20), resolving a conflict with Google Chrome's Local Network Access restrictions (Chrome 142+). - Update all docs referencing the initial resolved IP default across private/public hostname routing, Cloudflare Mesh hostname routes, egress policy host selectors, Access private apps, reserved IP reference, and related partials/glossary - Remove Beta badges from "Connect a private hostname" and "Egress through Cloudflare Tunnel" (GA) - Add new how-to page: Configure initial resolved IPs (Dashboard + API instructions, using CURL pending upstream OpenAPI schema pin update for APIRequest support) - Fix reserved-ips.mdx Split Tunnel Exclude-mode math now that the default range sits outside CGNAT space - Add changelog entry
…agram Review findings: - Fix remaining hardcoded 100.80.0.0/16 in MeshHostnameRoutingDiagram.astro (CR-0248079a6e48) - Remove contraction, use root-relative internal link, remove directional words (above/below), split semicolon-joined clauses into separate sentences, and rewrite passive voice as active voice in reserved-ips.mdx and the changelog entry (SG-3dfd068375a0, SG-e45dffc72174, SG-344e30d2eb64, SG-5c7af6376962, SG-5b986e4edf2f, SG-983f7d771c3b, SG-29585027da84, SG-e7bfde642a70, SG-486f00ad5738, SG-261ff277316f, SG-01bc9aa619e4) - Skipping SG-6f7fe6807916 (2-item bullet list to prose) per PR comment New diagram: - Add TunnelHostnameRoutingDiagram.astro, modeled on the existing MeshHostnameRoutingDiagram.astro, showing the same generic flow (client -> Gateway -> connector -> destination) adapted for Cloudflare Tunnel and its dual private/public hostname destinations - Place it on connect-private-hostname.mdx (previously had no diagram). Not added to egress-cloudflared.mdx, which already has its own scenario-specific mermaid diagram for the AWS/egress example
Networking > IP addresses > Address space > Custom IPs is the designated place to view and change the initial resolved IP range (the dashboard now supports editing it there). Update the how-to page and changelog to only reference that UI, dropping the Device profiles and Routes mentions. Also move the changelog entry to Wednesday, 2026-08-12.
nikitacano
force-pushed
the
ncano/hostname-routing-public-ip-ga
branch
from
August 6, 2026 17:07
414c96d to
669917d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
11 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Hostname routing (Cloudflare Tunnel and Cloudflare Mesh) is now generally available. Alongside GA, the default IPv4 range used for Gateway initial resolved IPs (token IPs) is changing from a CGNAT range (
100.80.0.0/16) to a public Cloudflare-owned range (172.64.128.0/20), resolving a conflict with Google Chrome's Local Network Access restrictions (Chrome 142+). IPv6 (2606:4700:0cf1:4000::/64) is unchanged.Changes
host-selectors.mdx) remains a separate, still-beta Gateway feature and is unaffected.<CURL>instead of<APIRequest>since theinitial_resolved_ipendpoint isn't yet in the docs site's pinned OpenAPI schema commit. Follow-up: switch to<APIRequest>once that schema pin updates.reserved-ips.mdx— the new default range sits outside CGNAT space entirely, so the "add back" CIDR example changes.TunnelHostnameRoutingDiagram.astro, modeled on the existingMeshHostnameRoutingDiagram.astro, showing the client → Gateway → Tunnel → destination flow for hostname routing. Placed on Connect a private hostname, which previously had no diagram.100.80.0.0/16in the existingMeshHostnameRoutingDiagram.astro.Notes for reviewers
DashButtondeeplinks andCURL/APIRequestusage against this repo's route/schema validation before pushing. The Custom IPs deeplink (/ip-addresses/address-space/custom-ips) was added todash-routes/core-manually-defined.jsonsince it's a real route not yet in the auto-generated snapshot.MeshHostnameRoutingDiagram.astrohas a pre-existinglist-style: noneaccessibility gap (same pattern fixed in the new Tunnel diagram) and an unused--map-subtleCSS variable, both predating this PR. Left as a follow-up rather than expanding scope here.